Now, due to remote work environments, businesses should pay special attention to their cybersecurity protocols. What can companies do to shorten their security gap?
There’s an undeniable reality: every day, companies are exposed to different types of cyberattacks. Today big companies (banks included), as well as less notorious businesses, are targets of phishing, malware, ransomware, and cyberterrorism.
For Jaime Baracaldo, Chief Information Officer and the cybersecurity expert at Location World, this issue is becoming more serious, because of how fast the technological market is evolving and how quickly cybercriminals are upgrading their skills. It would be naive to believe that companies, both big and small, won’t be exposed to cyberattacks at any given moment.
Being prepared for cyber threats is vital for companies that expect to grow. Building a strong security foundation in-house is the first step. It is important to have bulletproof security protocols that can also benefit both companies’ clients and suppliers.
With the arrival of remote work as the new standard, many companies face a new reality a lot sooner than expected (this working model was supposed to be the rule in the late 2020’s or early 2030’s). Companies are no longer limited by the need for physical spaces or even physical resources. Workplace structure went through a complete transformation, creating expansive virtual teams that need to adapt to different needs and challenges. The downside is this new scenario offers less control of employees and their processes. That is why companies urgently need to expand their perimeters to the outside world without losing sight of concepts like Zero Trust, a method that will probably stick around because it can offer improved management of accesses and processes, when facing new security risks.
The three pillars of cyber security
Coming from his own experience, Baracaldo suggests focusing on three major fronts when it comes to assuring a solid cybersecurity system: people, processes, and technologies:
1.-People: having the most advanced processes and technologies is not enough if the people who work with them are not constantly aware of possible threats. People should work as “human filters”, Baracaldo stresses.
2.-Processes: if you instruct users on how to behave when faced with certain risks, you establish a clear protocol to be executed quickly and effectively when necessary.
3.-Technologies: in an ever-changing reality, technology keeps rapidly evolving. Not long ago, we didn’t even take information storage into account, and we hardly ever thought about processing workload-related information on the cloud. Today, this is a reality in most companies. Security processes that use technology are the rule nowadays and some of them even use tools that allow interconnections between different types of systems to identify indicators that show potential threats so that the right kind of action can be taken.
Working with people, processes and technologies can help us do a complete scan of data security in every company; yet Baracaldo emphasizes the fact that the first step is building the right kind of work culture. Baracaldo explains: “There are so many information leaks, as shown in different security tests in different Latin-American countries. Many companies can be described as secure because their processes are relatively shielded from cyber threats. But when they interact with suppliers they experience information leaks and are forced to face unexpected security challenges”.
From this point of view, and as stated before, employees must become “human firewalls”, and act as the first defense line to promote security in-house and outside.
Data theft prevention
In 2019, Microsoft blocked more than 13 billion malicious and suspicious emails, from which more than a billion were URLs exclusively created to trigger phishing attacks and steal credentials.
To avoid being targeted by this type of attack, many companies have developed DLP systems (Data Loss Prevention). These are designed to be constantly aware of the kind of information that is shared outside each company, through scanning of emails, cloud uploads, and storage systems (by sorting out different types of data). Baracaldo insists on relying on DLP, since these systems can be extremely smart, to the point that they’re able to track risky behavior, creating red flags or blocking malicious emails.
With the help of conscious users, these technologies avoid data theft, and its catastrophic consequences, being “ransomware” one of the most problematic. A company is affected by ransomware when a cybercriminal “kidnaps” its data, and demands a ransom to release it. Baracaldo believes that “companies must have contingency security plans equipped with the right type of technology, strong processes, and well-trained employees. It is also smart to pay for security insurance to mitigate losses that come from cyberattacks, and protect companies, their reputation, and their assets.”
The new challenges of the remote working environment
This new reality has put in motion a fast digital transformation for most companies. Some of them have made it, some are still struggling, and others have failed. Nevertheless, having a team made of people that can be anywhere in the world comes with new security challenges, and it’s good judgment to apply the following strategies:
-Implementing two-factor authentication. That means that if someone logs into the company’s platform, its system should always ask for extra access credentials, like a security code or PIN, via SMS or an authentication app through the user’s cellphone, to confirm their identity. This way companies can prevent potential hackers from stealing credentials that give them access to the company’s platform and eventually to confidential data.
-Applying new technologies that can, somehow, mimic the kind of control company’s used to have when working in a traditional environment (on a physical space). This can be achieved by building solid security measures, such as automatic cookie and display blocking, OS upgrades, and remote computer and phone reset, also known as MDM (Mobile Device Management). This way, companies can make sure that passwords will be constantly monitored and updated, among other things.
-Implementing federated identities to access apps (Centralized Trust) and Unified Single Sign-On. These types of controls, among many others that can be implemented today, can help promote secure environments within organizations. Applying the Zero Trust concept is always a safe bet because it promotes greater control of access based on roles, not only on hierarchies. This concept has been widely promoted by technological market giants such as Microsoft, Google, Akamai, among others.
The bottom line is that companies must carry out a diagnosis of the level of threat and risk to which the organization is exposed. This is the first step to plan the next moves, in terms of investments and action plans. These must involve security awareness campaigns for their employees and suppliers, as well. That way companies can prevent theft and leakage of information from attacks like phishing, smishing, or ransomware, to name a few.